CVE-2021-4350

The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated HTML Injection in versions up to, and including, 18.2. This is due to lacking authentication protections on the wpfm_send_file_in_email AJAX action. This makes it possible for unauthenticated attackers to send emails using the site with a custom subject, recipient email, and body with unsanitized HTML content. This effectively lets the attacker use the site as a spam relay.

• CWE-862
• CWE-862

• https://blog.nintechnet.com/wordpress-frontend-file-manager-plugin-fixed-multiple-critical-vulnerabilities/Exploit
• https://www.wordfence.com/threat-intel/vulnerabilities/id/49150180-9de0-4318-b21b-779daaeb7a52?source=cveThird Party Advisory
• https://blog.nintechnet.com/wordpress-frontend-file-manager-plugin-fixed-multiple-critical-vulnerabilities/Exploit
• https://www.wordfence.com/threat-intel/vulnerabilities/id/49150180-9de0-4318-b21b-779daaeb7a52?source=cveThird Party Advisory

Published

Jun 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43492AlquistManager branch as of commit 280d99f43b11378212652e75f…7.5
• CVE-2021-43493ServerManagement master branch as of commit 49491cc6f94980e6…7.5
• CVE-2021-43494OpenCV-REST-API master branch as of commit 69be158c05d4dd5a4…7.5
• CVE-2021-43495AlquistManager branch as of commit 280d99f43b11378212652e75f…7.5
• CVE-2021-43496Clustering master branch as of commit 53e663e259bcfc8cdecb56…7.5
• CVE-2021-43498An Access Control vulnerability exists in ATutor 2.2.4 in pa…7.5
• CVE-2021-43503Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-43505Multiple Cross Site Scripting (XSS) vulnerabilities exist in…5.4
• CVE-2021-43506An SQL Injection vulnerability exists in Sourcecodester Simp…9.8
• CVE-2021-43509SQL Injection vulnerability exists in Sourcecodester Simple …9.8
• CVE-2021-4351The Frontend File Manager plugin for WordPress is vulnerable…5.3
• CVE-2021-43510SQL Injection vulnerability exists in Sourcecodester Simple …9.8